Changelog 2026.3.2 #592

Pimcore 2026.3.2

Bugfix release of Pimcore platform version 2026.3. This changelog is generated from the 2026.3.2 milestones of all Pimcore packages and refreshed every day until every package is released. Open tasks show what is still planned for this release.

Packages

33 further packages of this platform version without changes in 2026.3.2.

Changes by package

backend-power-tools-bundle _Enterprise

_{Not released yet · 2 open tasks}

⏳ Open tasks

• [Duplicate search] Split DuplicateListRepository below Sonar's 20-method limit (#806)
• [Duplicate search] Start the wizard's assignments provider unaimed (#796)

data-hub

_{Not released yet · 1 open task}

⏳ Open tasks

• Make getDocument folder-safe (resolve document folders) (#1126)

data-hub-file-export _Enterprise

_{Not released yet · 1 open task}

⏳ Open tasks

• Use tmp file to get the filename for emails ([Bug]: Document preview and thumbnail are suppressed when the page count is not known #382)

data-importer

_{Not released yet · 1 change · 1 open task}

• [Studio] Keep import execution available for read-only configurations (#684)

⏳ Open tasks

• Stream import files in interpreters to reduce memory usage (#686)

data-quality-management-bundle _Enterprise

_{Not released yet · 1 open task}

⏳ Open tasks

• [Data Quality Management] Allow bundles to register class editor forms for custom rule definitions ([Studio UI] Ask for confirmation before moving folders in the element tree #345)

generic-data-index-bundle

_{Not released yet · 2 changes}

• Fix TypeError when resetting dispatched index queue items (#528)
• Fix TypeError for number filters with a decimal value (#527)

paas _Enterprise

_{Not released yet · 3 open tasks}

⏳ Open tasks

• Support Upsun Cloud object storage in the S3 template, disable retain_visibility ([self-heal] Fix Tests failure in API Tests #180)
• Mercure client url (Prepare 2026.2 #177)
• Improve bundle install (Class definition with class name: SaameProduct not found #171)

pimcore

_{Not released yet · 22 changes · 2 resolved issues · 13 open tasks}

🔒 Security

• Only allow registered controllers for document and editable controller references (#19513)
• GHSA-38pc-xxpc-x298: close CGNAT/NAT64/6to4 gaps in SsrfProtection (#19500)
• GHSA-xw5x-q46c-wh4j: fix PHP object injection via date-type properties (#19497)
• GHSA-w9v9-v3mj-g4cp: hard-block content-model mutation methods in Twig sandbox (#19496)
• GHSA-5r64-jvx7-m58v: thumbnail delivery bypasses extension allowlist, allowing web-root PHP write (#19495)
• GHSA-mfr4-5hr5-jqvg: Scheduled publish-version task overwrites arbitrary elements via unvalidated version ID (IDOR) (#19488)
• GHSA-h78x-47qg-qjmq: Escape output and sanitize href in DataObject Data\Link::getHtml (#19484)
• GHSA-f5q9-27jc-vxm9: Twig sandbox bypass via prefix auto-allow (arbitrary file read/delete) (#19483)

🐛 Bug fixes

• [Asset] Detect SOURCE/print thumbnail format case-insensitively (#19544)
• [Document] Guard Video editable against non-string poster/path from editmode (#19543)
• [Element] Default Recyclebin\Item::$deletedby to an empty string (#19542)
• [Asset] Don't fclose() a stream the storage adapter already closed (#19539)
• Calculate relation delta against the current database state on save (#19538)
• [DataObject] Waive mandatory check for defaults that are resolved at runtime (#19534)
• [DataObject] Resolve the shared select options provider when only the provider type is persisted (#19529)
• [Data Objects] Video: don't fail normalize() on deleted assets (#19527)
• Allow same user/role folder name under different parents (PEES-1660) (#19526)
• Keep localized relations of object bricks sharing field names apart (#19522)
• Fix Asset::getMetadata() returning wrong value with language variants (#19467)
• Fix uncaught TypeError in IncludeRenderer when include is a numeric string (#19440)
• [Layout] Default typed string properties to empty string to avoid uninitialized access (#19438)
• [DataObject] Escape relation metadata in the advanced-relation version preview (#19403)

✅ Resolved issues

• Validation failed: Passing relations multiple times not allowed anymore: object-10485 multiple times in field AddRelatedProducts (#17604)
• Duplicate fieldnames for localized object brick relations not working (#9701)

⏳ Open tasks

• [GenericExecutionEngine] Map JobRun context column as nullable (#19535)
• Treat an empty select default value as unset (#19532)
• [Assets] Don't call getAsset() on thumbnails without an asset (#19530)
• Make log archive deletion tolerate concurrent removal (#19512)
• [Asset] Keep the nullable contract of getStreamedResponseByUri() when the thumbnail storage fails (#19471)
• Fix duplicate class constant when field names collide (#19466)
• [DataObject] Do not evaluate calculated values or load reverse relations for consumers that discard them (#19423)
• Imagick materialize clip path before thumbnail transforms (#19406)
• Fix workflow support strategy crashing on a blank expression (#19343)
• Fix Major Version in Version Class (#19279)
• Un-deprecate Kernel::configureContainer() and Kernel::configureRoutes() (#19264)
• Fix nullable context column mapping for JobRun (#19176) (#19231)
• Asset Versions are Created for First Asset Upload (#18420)

pimcore-wysiwyg-editor

_{Not released yet · 1 open task}

⏳ Open tasks

• Make a change applied from the code view undoable (#30)

portal-engine _Enterprise

_{Not released yet · 3 changes}

🐛 Bug fixes

• Fix zip upload into the upload folder failing with "Create permission missing" (#1071)

🧰 Other changes

• [Portal] Client-side navigation for the Studio frontend (on by default) (#1069)
• [Portal] Draw the cart, saved-search and public-share rows with the kit's ListRow (#1054)

studio-backend-bundle

_{Not released yet · 8 changes · 3 open tasks}

🐛 Bug fixes

• [Translations] Make the login error dialog labels public (#2089)
• Fall back to the element when its version data cannot be loaded (#2088)
• Allow purely numeric editable names when saving documents (#2087)
• Return the requested document's language in document translations (#2084)
• Accept null localized data when saving object bricks (#2077)
• [Grid] Fix locale fallback and null export for advanced column source fields (#2071)
• Clear cached permission definitions on cache:clear (#2067)

🧰 Other changes

• [2026.3][Class] Require objects permission for the custom layout editor collection route (#2079)

⏳ Open tasks

• Allow sent-emails list with emails OR gdpr_data_extractor permission (#2086)
• Fixes Studio: element references resolve to the wrong element when a document, asset or object share the same numeric id #467: Key the element reference cache by type as well as id (#2032)
• Grid export: allow specifying the download file name (#2023)

studio-ui-bundle

_{Not released yet · 7 changes · 3 open tasks}

🐛 Bug fixes

• Show element validation messages verbatim instead of as translation keys (#4173)
• Keep colons in Select/Multiselect option labels (#4172)
• Keep the first edit in an object brick with empty localized fields (#4169)
• Keep advanced columns in CSV and XLSX exports (#4166)
• Fix advanced column transformer defaults and empty-pipeline preview (#4156)
• Paint CodeEditor from the theme instead of CodeMirror's light default (#4025)

🧰 Other changes

• [2026.3][Studio] Translate layout titles in language comparison view (#4170)

⏳ Open tasks

• Use the configured API prefix for hand-built Studio URLs (#4183)
• [Element] Report the outcome through executeElementTask's onFinish (#4146)
• [Modals] Revise icon use in all modals (#3848)

_{Last update 2026-10-10 06:54 UTC · 2 internal changes (CI, documentation, tests) not listed · Enterprise = package of the Pimcore Enterprise subscription, repository not public · Generated automatically from the GitHub milestones of all Pimcore packages.}